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Subject: Telefonica/O2 response to ICO"s draft Data Sharing Code of Practice 
Date: 09 September 2019 21:01:31 
Hello, 


O2 considers the draft Data Sharing Code of Practice to provide useful further guidance 
regarding how organisations can further evidence their compliance with data protection 
standards, but we would welcome further clarification around the data sharing agreement (DSA) 
recommendations please. What format does the ICO expect a DSA to take? The recommended 
content for a DSAs is extensive and detailed, and O2 considers that much of the recommended 
detail will already be covered across a variety of documents/processes relating to the relevant 
data sharing, for example a DPIA, privacy policy, data sharing policy and a specific contract 
between the two controllers. In these instances, would a separate, distinct DSA also be required, 
or is it sufficient for the relevant content and information to be covered across multiple 
documents/processes? If individual DSAs are required for each example of data sharing across 
O2’s business (in addition to the documents and processes already in place) then we are 
concerned that this will be burdensome and untenable for data heavy businesses such as 02 — 
particularly if the DPO is expected to be involved directly in each DSA. O2 also considers that it 
would be useful for the ICO to provide further guidance, clarity and examples around what data 
sharing would be considered to be “necessary”, rather than “useful or standard practice”, and 
the differences between the two concepts — as “necessary” seems to be a very high bar to meet. 
We would appreciate if the ICO would be able to provide further information and clarifications 
on the above issues surrounding DSAs. 


If you have any questions or would like to discuss further then please do let us know. 


Many thanks, 


| Telefónica UK Limited 


Legal & Regulatory Team 


260 Bath Road, Slough, SLi 4DX, UK 
aay 


Advance holiday warning: 
13 — 16 September (inclusive) 
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